Proud to work alongside these two 🔥 Congrats to you both!.

Best case scenario: send the VPN logs to a SIEM solution for safekeeping. VPN compromises are on the rise, and this will save you a lot of heartache in the heat of an incident.

If not, some awkward conversations need to be had. .

If your organisation uses a third-party managed IT provider, and said IT provider says you have a shiny VPN with logging enabled. Please challenge the provider to prove that the VPN logs are configured correctly. A trusted IT partner will be happy to do this.

RT @CyberRaiju: details hundreds of publicly disclosed DLL Hijacking opportunities. With over 700 stars on GitHub a….

RT @CyberRaiju: Sample deployed via low detection Octowave Loader caught:.- econusi[.digital/nwmb. Interestingly lo….

RT @sudo_Rem: Check out what @HuntressLabs has been busy with this weekend! If you're an IR/SOC analyst responding….

Quality breakdown here from @xorJosh @Antonlovesdnb @Purp1eW0lf.

IOC’s.hxxps[:]//t680run[.]cfd/vr8DHkGqPInmyncl/1.hxxps[:]//t680run[.]cfd/wbxceTpV20sDchGn/1.hxxps[:]//t680run[.]cfd/KhbOIQRfvJEauW2K/1.

Obfuscated second stage:

Straight out of the lab today, we observed a ClickFix malware campaign hosted on various .cfd domains using ProtWare’s HTML guardian software to obfuscate the second stage payload:

RT @_JohnHammond: We wrote up what @HuntressLabs has been seeing for the CrushFTP authentication bypass: CVE-2025-31161 (or CVE-2025-2825,….

RT @Antonlovesdnb: Got a new @HuntressLabs blog out today looking at a case that @Purp1eW0lf @xorJosh and I worked on recently - VPN compro….

Special thanks to @xorJosh for the assistance on this investigation.

IOC’s Continued:. NetSupport Primary C2 Domain - kidsman1[.]net. NetSupport Secondary C2 Domain - solofarm[.]duckdns[.]org.

IOCs. Initial Lure Domain - magicvision[.]app. 2nd Stage URL - hxxps[:]stats-lord[.]net/update[.]php. Binary - MagicVision_1.6.0_x64_v1.exe. SHA-256 Hash - 8df95c54c5dc1c4f7bdeebab19fd0b7feba4ddfe26305e679de01a56cf31dbaa.

During the final stage of this malware chain, a renamed version of 7z.exe (zz.exe) is downloaded to the host and used to unzip the contents of “b.vue”, which was an archive file that contained the NetSupport RAT:

As a result of this interaction, the malware makes network connections to the URL hxxps[:]stats-lord[.]net/update[.]php to read the second stage payload:

An end user downloads the executable “MagicVision_1.6.0_x64_v1.exe” from the domain magicvision[.]app:

We have identified a malware campaign posing as a generative AI application to deliver NetSupport RAT. We observed that the threat actor made various press releases in an attempt to legitimise this campaign:.